Austria: Announced DSB Statement on Data Protection in the AI Act

On 1 June 2024, the Data Protection Authority (DSB) published a Statement on Data Protection in the AI Act. The DSB emphasises that the General Data Protection Regulation (GDPR) remains applicable even after the Artificial Intelligence Act comes into effect. This applies to both the private and public sectors when personal data is processed using AI systems. In the private sector, companies must comply with GDPR when developing and using AI. They need a valid basis for processing personal data under GDPR and additional safeguards for sensitive data. The burden of proof for compliance lies with the data controller. In the public sector, AI can improve administrative efficiency, but data protection laws must be strictly followed. The DSB noted that GDPR applies alongside the AI Regulation, and a legal basis for data processing continues to be required.